CVE-2026-15978

SGLang contains a vulnerability where, if no API keys are configured, two exposed endpoints allow a remote attacker to trigger distributed weight broadcasting via NCCL and initiate data transfer, enabling exfiltration of all model weights. Affected component: SGLang; vulnerability type: model wei...

EUVD-2026-51266

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...

PT-2026-66563

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights...